RedHook Android RAT Abuses Wireless ADB via Accessibility Service to Gain Shell-Level Device Access
RedHook Android RAT Abuses Wireless ADB via Accessibility (TL-2026-1248), also tracked as RedHook Banking Trojan, is a high-severity malware campaign, first published 2026-07-12. It is attributed to RedHook Operators (China) with low confidence, affects Google Android OS, maps to 25 MITRE ATT&CK techniques (T1005, T1041, T1071.001), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-1248
- Threat ID
- TL-2026-1248
- Also known as
- RedHook Banking Trojan, RedHook RAT
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-12
- Last reviewed
- 2026-07-12
- Attribution
- RedHook Operators
- Attribution confidence
- LOW
- Nation-state nexus
- China
- Motivation
- FINANCIAL
- Target sectors
- finance, government administration, banking, consumer mobile
- Target regions
- vietnam, indonesia, Southeast Asia
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in RedHook Android RAT Abuses Wireless ADB via Accessibility
Malware and tooling: RedHook, Shizuku
An upgraded variant of the RedHook Android RAT abuses Accessibility Service permissions to silently enable Developer Options and Wireless Debugging, then connects to the on-device ADB daemon over loopback (127.0.0.1) to obtain shell (uid 2000) privileges without root or USB access, then deploys embedded Shizuku-derived code to execute privileged commands. It supports 53 server-issued commands including screen streaming, keystroke interception, credential theft, and camera activation, and is distributed via social engineering impersonating government and financial institutions.
How RedHook Android RAT Abuses Wireless ADB via Accessibility works
RedHook is an Android remote access trojan first documented by Cyble Research and Intelligence Labs in July 2025 as a banking trojan targeting Vietnamese users, distributed through phishing sites impersonating the State Bank of Vietnam (sbvhn[.]com), Sacombank, Central Power Corporation, the Traffic Police of Vietnam (CSGT), and the Vietnamese government. The original variant abused Accessibility Services and overlay permissions to harvest keystrokes, capture the screen via the MediaProjection API, and exfiltrate SMS, contacts, and banking credentials through a WebSocket-based RAT supporting 34 server-issued commands. APKs were hosted on an exposed AWS S3 bucket and CloudFront distribution; sequential user IDs in the leaked infrastructure suggested over 500 infected devices. Chinese-language strings in logs and leaked screenshots suggest a Chinese-speaking developer or operator.
In July 2026, Group-IB documented a significantly upgraded RedHook variant that is the first malware observed abusing Android's Wireless ADB (Wireless Debugging) feature to autonomously self-escalate privileges. Using its existing Accessibility Service foothold, the malware programmatically simulates the exact UI interactions a user would perform to enable Developer Options, activate Wireless Debugging, and pair itself as an authorized computer -- all invisibly, behind a full-screen overlay or fake system update dialog. It then launches an embedded ADB client (referenced internally as "libmx.so") that connects to the on-device adbd daemon over the loopback interface and spawns a privileged shell process at uid 2000 (the Android `shell` user). This shell-level access is functionally equivalent to what the legitimate open-source Shizuku framework provides to enthusiasts seeking elevated permissions without rooting; RedHook embeds Shizuku-derived logic to run a persistent privileged server that can grant itself additional runtime permissions, write to `Settings.Secure` (including `WRITE_SECURE_SETTINGS`), execute arbitrary shell commands, silently install/uninstall applications, and capture raw touch input -- all without further user prompts. This escalation path requires no root and no USB/OEM unlocking, working on any Android 11+ device that supports Wireless Debugging, which is the overwhelming majority of the current install base.
The command set has grown to 53 server-issued functions covering device reconnaissance, UI automation (taps, swipes, gestures, drags, long presses), notification bar access, contact/app/SMS harvesting, UI-layout (accessibility node tree) exfiltration, silent APK install/uninstall, text injection and navigation control, screen capture (screenshot and continuous streaming via WebSocket and, once privileged, RTMP), camera activation, device reboot, permission-check and grant primitives, fake system-update overlays, ADB-prompt dismissal automation, and OEM-specific routines tuned for Samsung, Xiaomi, Oppo, Vivo, Huawei, Meizu, and Google devices.
Persistence is achieved through a layered stack: a 1x1-pixel foreground activity that keeps the app foreground-classified even with the screen off; silent background audio playback via a MediaSession to win elevated OS process priority; a held WakeLock to defeat battery-optimization suspension; two mutually-monitoring internal services that relaunch each other via BIND_AUTO_CREATE if either is killed; a five-minute watchdog alarm that re-verifies service health; a BOOT_COMPLETED receiver for post-reboot restoration; and an oom_score_adj value of -1000 that exempts the process from Android's low-memory killer.
Distribution continues via social engineering: operators impersonate government officials or bank support staff over phone calls and messaging apps (Zalo is specifically documented), directing victims to fake Google Play Store replica sites to download a malicious APK. Targeting has expanded from Vietnam to Indonesia and the broader Southeast Asia region. C2 infrastructure for the 2026 variant uses the domain 3n7wj[.]com with dedicated API and WebSocket subdomains; the original 2025 campaign used iosgaxx423[.]xyz and jftxm[.]xyz infrastructure alongside AWS S3/CloudFront-hosted payloads.
MITRE ATT&CK techniques used in TL-2026-1248
Collection
T1005 Data from Local System; T1113 Screen Capture; T1125 Video Capture; T1636.003 Contact List; T1636.004 SMS Messages
Exfiltration
T1041 Exfiltration Over C2 Channel
Command and Control
T1071.001 Web Protocols; T1571 Non-Standard Port
Discovery
T1082 System Information Discovery; T1418 Software Discovery
execution
collection
credential-access
Persistence
T1541 Foreground Persistence; T1547 Boot or Logon Autostart Execution; T1624.001 Broadcast Receivers
Privilege Escalation
T1548 Abuse Elevation Control Mechanism; T1548.004 Elevated Execution with Prompt
Defense Evasion
Impact
Resource Development
Execution
T1623 Command and Scripting Interpreter
defense-evasion
T1629 Impair Defenses; T1655 Masquerading
initial-access
Affected products and versions in RedHook Android RAT Abuses Wireless ADB via Accessibility
- Google — Android OS
Vulnerable versions: Android 11; Android 12; Android 13; Android 14; Android 15 - Samsung — Android devices (OEM-specific accessibility routines)
Vulnerable versions: Android 11+ - Xiaomi — Android devices (OEM-specific accessibility routines)
Vulnerable versions: Android 11+ - OPPO — Android devices (OEM-specific accessibility routines)
Vulnerable versions: Android 11+ - Vivo — Android devices (OEM-specific accessibility routines)
Vulnerable versions: Android 11+ - Huawei — Android devices (OEM-specific accessibility routines)
Vulnerable versions: Android 11+ - Meizu — Android devices (OEM-specific accessibility routines)
Vulnerable versions: Android 11+
Remediation for RedHook Android RAT Abuses Wireless ADB via Accessibility
Patches
- No CVE / vendor patch applies -- this abuses legitimate Wireless ADB functionality rather than a vulnerability; Android OEMs could add a hardened confirmation step before Wireless Debugging pairing that Accessibility Services cannot programmatically bypass
Immediate actions
- Block C2 domains and subdomains: api.3n7wj[.]com, skt.3n7wj[.]com, sktv.3n7wj[.]com at DNS/perimeter
- Block legacy RedHook infrastructure: iosgaxx423[.]xyz, jftxm.xyz, sbvhn[.]com, mailisa[.]me, e13falsz.xyz
- Alert on outbound WebSocket connections to the above domains from mobile device management (MDM) egress
- Instruct users never to enable Wireless Debugging or Developer Options at the request of an app, phone call, or messaging-app prompt
- Uninstall APKs sideloaded from non-Play Store sources matching the SHA-256 IOCs listed
Workarounds
- Disable Developer Options entirely on non-developer end-user devices
- Restrict Accessibility Service permission grants to a vetted allowlist via enterprise mobility management
- Require biometric/PIN re-authentication before any Settings.Secure write, including Wireless Debugging toggles
Longer-term hardening
- Deploy Mobile Threat Defense (MTD) / EMM policies that alert on or block enablement of Developer Options and Wireless Debugging on managed devices
- Enforce Google Play Protect and block sideloading (unknown-sources installs) via MDM on corporate-enrolled Android devices
- Monitor for Accessibility Service grants to non-allowlisted applications via UEM/EMM
- User awareness training on government/bank impersonation via phone calls and messaging apps (Zalo and similar regional platforms)
Weaknesses (CWE) in RedHook Android RAT Abuses Wireless ADB via Accessibility
CWE-250, CWE-269, CWE-451
Timeline of RedHook Android RAT Abuses Wireless ADB via Accessibility
- AWS S3 bucket used to host RedHook APK payloads (nfe-bucketapk.s3.ap-southeast-1.amazonaws[.]com) becomes active with operational logging data.
- First RedHook malware samples observed in the wild targeting Vietnamese banking users.
- Cyble analysis of sequential user IDs found in the leaked/exposed AWS S3 operational data reveals that over 500 Android devices had likely been infected by the original RedHook campaign at time of discovery.
- Cyble Research and Intelligence Labs publicly discloses the original RedHook Android banking trojan, documenting 34 server-issued commands and phishing campaigns impersonating the State Bank of Vietnam, Sacombank, and Vietnamese government agencies.
- Group-IB documents expansion of RedHook targeting beyond Vietnam into Indonesia and the broader Southeast Asia region.
- Group-IB details RedHook's layered anti-kill persistence stack: a 1x1-pixel foreground activity, silent MediaSession audio playback, a held WakeLock, two mutually-resurrecting internal services bound via BIND_AUTO_CREATE, a five-minute watchdog alarm, a BOOT_COMPLETED receiver that restores shell-uid privileges within seconds of reboot, an oom_score_adj of -1000, and mlock()-based memory page pinning.
- Group-IB documents growth of RedHook's server-issued command set from 34 commands (2025 variant) to 53 commands (2026 variant), adding UI automation, ADB-prompt dismissal, RTMP-based privileged screen streaming, and OEM-specific routines.
- Group-IB publishes analysis of an upgraded RedHook variant that is the first documented Android malware to abuse Wireless ADB (Wireless Debugging) for autonomous, root-free shell-level privilege escalation via embedded Shizuku-derived code, including the mechanism of simulating 7 taps on the build-number field to unlock Developer Options.
- BleepingComputer reports on the upgraded RedHook Wireless ADB technique, summarizing the Group-IB findings for a wider security audience.
Sources cited for RedHook Android RAT Abuses Wireless ADB via Accessibility
- RedHook Android malware now uses Wireless ADB for shell access
- RedHook Returns with a Dangerous Upgrade
- RedHook Android RAT Abuses ADB Wireless Debugging to Gain Shell-Level Access
- RedHook Abuses Accessibility Service to Enable Developer Options and Wireless Debugging
- Android RAT RedHook Uses Wireless ADB to Silently Grant Permissions and Control Devices
- RedHook: A New Android Banking Trojan Targeting Users In Vietnam
Threats related to RedHook Android RAT Abuses Wireless ADB via Accessibility
Detection coverage for TL-2026-1248
As of 2026-07-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1248 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.